/ip firewall export
# jan/02/1970 03:47:17 by RouterOS 5.4
# software id = 3XIZ-7GSZ
#
/ip firewall address-list
add address=192.168.0.0/16 disabled=no list=vpn
add address=184.123.123.123 disabled=no list=vpn
/ip firewall connection tracking
set enabled=yes generic-timeout=10m icmp-timeout=10s tcp-close-timeout=10s tcp-close-wait-timeout=10s tcp-established-timeout=1d tcp-fin-wait-timeout=10s tcp-last-ack-timeout=10s \
    tcp-syn-received-timeout=5s tcp-syn-sent-timeout=5s tcp-syncookie=no tcp-time-wait-timeout=10s udp-stream-timeout=3m udp-timeout=10s
/ip firewall filter
add action=accept chain=input comment="Allow Ping" disabled=no protocol=icmp
add action=accept chain=input comment="Allow VPN" disabled=no src-address-list=vpn
add action=accept chain=input comment="Allow NAT" connection-state=related disabled=no in-interface=ether1-gateway
add action=accept chain=input comment="Allow NAT" connection-state=established disabled=no in-interface=ether1-gateway
add action=log chain=input comment="Log NetOp" disabled=no dst-port=6502 log-prefix=netop protocol=tcp
add action=accept chain=input comment="Allow Published Services" disabled=no dst-port=6502,443,3389 in-interface=ether1-gateway protocol=tcp
add action=accept chain=input comment="Allow WinBox Remote" disabled=no dst-port=8291,80,3389 in-interface=ether1-gateway protocol=tcp
add action=log chain=input comment="Log All Denied" disabled=no in-interface=ether1-gateway log-prefix=""
add action=drop chain=input comment="Deny All" disabled=no in-interface=ether1-gateway
/ip firewall nat
add action=accept chain=srcnat comment="Do Not NAT VPN Tunnel" disabled=no dst-address=192.168.0.0/24 src-address=192.168.53.0/24
add action=dst-nat chain=dstnat comment="Publish WebServer" disabled=yes dst-port=80 in-interface=ether1-gateway protocol=tcp to-addresses=192.168.88.254 to-ports=80
add action=redirect chain=dstnat comment="Transparent WebProxy" disabled=no dst-port=80 in-interface=bridge protocol=tcp to-ports=8080
add action=dst-nat chain=dstnat comment="Publish XenCenter" disabled=no dst-port=443 in-interface=ether1-gateway protocol=tcp to-addresses=192.168.53.3 to-ports=443
add action=dst-nat chain=dstnat comment="Publish Remote Desktop" disabled=no dst-port=3389 in-interface=ether1-gateway protocol=tcp to-addresses=192.168.53.13 to-ports=3389
add action=dst-nat chain=dstnat comment="Publish NetOp" disabled=no dst-port=6502 in-interface=ether1-gateway protocol=tcp to-addresses=192.168.53.10 to-ports=6502
add action=masquerade chain=srcnat comment="NAT Local Network" disabled=no out-interface=ether1-gateway
/ip firewall service-port
set ftp disabled=no ports=21
set tftp disabled=no ports=69
set irc disabled=no ports=6667
set h323 disabled=no
set sip disabled=no ports=5060,5061
set pptp disabled=no